NIST CSF
Standard · No cert · ongoing
- Controls
- Functions: Govern, Identify, Protect, Detect, Respond, Recover (CSF 2.0)
- Recertification
- No certification; maturity-based self-use
- Oversight
- NIST (voluntary framework)
- Common gaps
- Governance, asset inventory, incident response
- Related
- ISO 27001, SOC 2 Type 2
- Public registry
- NIST ↗
What is NIST CSF?
The NIST Cybersecurity Framework is a voluntary, outcome-based framework for managing cyber risk. CSF 2.0 organizes outcomes into six functions, including the newer Govern function.
Is NIST CSF a certification or an attestation?
It is neither — there is no NIST CSF certificate. Organizations use it to structure and measure their program, often as scaffolding beneath SOC 2 or ISO 27001.
Who needs NIST CSF?
Any organization wanting a common language for cyber risk; frequently used to align stakeholders before pursuing a certifiable framework.
What does it cost and how long does it take?
There is no audit fee; cost is the internal effort of adopting and maturing against the framework.